A curated list of tools and resources for understanding codebases and software systems.
A workspace can include one repository or many. It may connect applications, services, libraries, infrastructure, tests, and documentation. Workspace intelligence helps developers and AI tools understand how those parts fit together and change over time.
Workspai contributors maintain this list, but Workspai is reviewed under the same governance rules as every other entry.
- Start Here
- Foundations and Architecture
- Workspace Discovery and Inventory
- Repository and Code Understanding
- Workspace Models and Software Graphs
- Change and Impact Intelligence
- Policies and Verification
- AI Context and Agents
- Protocols and Integrations
- Evaluation and Benchmarks
- Research and Learning
- Related Lists
- Contributing
- License
Workspace intelligence is broader than repository search and narrower than general developer tooling. A useful reference architecture is:
Repositories · Projects · Dependencies · Policies · Changes · Runtime
│
▼
Canonical System Model
│
▼
Evidence-backed Software Graph
│
▼
Diff · Impact · Health · Verify · Context · Explain
│
▼
Developers · CI · IDEs · AI agents
This is an architectural pattern, not a requirement that every listed project implement every layer. The list includes focused tools when they make one layer materially stronger and interoperable with the rest of the system.
- C4 Model - Describes software systems through hierarchical context, container, component, and code views with a shared visual vocabulary.
- Structurizr - Provides models, DSLs, tooling, and rendering workflows for architecture-as-code based on the C4 model.
- Team Topologies - Connects team boundaries, interaction modes, and cognitive load to the architecture and flow of software systems.
- Backstage System Model - Defines components, APIs, resources, systems, domains, groups, and ownership relationships for a software catalog.
- Devfile - Specifies portable development environments, commands, components, and events in a declarative workspace file.
- Backstage Software Catalog - Builds a centralized catalog from metadata stored with code and relates software components to ownership and operational tooling.
- Cortex - Maintains a service catalog that combines ownership, dependencies, standards, scorecards, and operational metadata.
- OpsLevel - Organizes services, systems, dependencies, ownership, maturity, and operational integrations in a developer portal.
- CycloneDX - Defines a bill-of-materials standard for software, services, vulnerabilities, dependencies, and supply-chain relationships.
- SPDX - Standardizes software package, file, licensing, security, and provenance information for interoperable inventories.
- Syft - Generates software bills of materials from container images and filesystems with package and dependency evidence.
- Tree-sitter - Produces concrete syntax trees incrementally across many languages for source discovery and structural analysis.
- Universal Ctags - Extracts names, kinds, locations, and language-specific symbols from a broad set of source formats.
- CodeQL - Creates queryable semantic representations of code for program analysis, security research, and cross-repository investigations.
- Graphify - Builds a local knowledge graph from code, documentation, schemas, and media with explainable extracted, inferred, and ambiguous edges.
- Joern - Builds code property graphs and provides a query language for analyzing program structure, data flow, and vulnerabilities.
- SCIP - Defines a language-agnostic indexing protocol for precise code navigation and cross-tool symbol intelligence.
- Semgrep - Applies structural and semantic rules across codebases for security, correctness, and organization-specific policy checks.
- Sourcegraph - Indexes code across repositories for search, navigation, ownership, batch changes, and code intelligence.
- Understand Anything - Builds an interactive codebase knowledge graph with structural, domain, dependency, and change-impact views.
- Doxygen - Extracts source structure, references, and documentation into navigable project documentation and diagrams.
- OpenWiki - Generates and incrementally maintains agent-oriented repository wikis, source maps, architecture notes, and linked project knowledge.
- Sourcetrail - Preserves a historical open implementation of interactive source indexing and dependency navigation.
- dependency-cruiser - Validates JavaScript and TypeScript dependency rules and exports module graphs for architecture analysis.
- jQAssistant - Scans software structures into Neo4j and evaluates executable architecture concepts and constraints.
- Repowise - Connects code and dependency graphs with Git history, generated documentation, architecture decisions, health, and change-risk evidence.
- Workspai - Builds a canonical workspace model and a revision-bound, proof-backed software graph for impact, verification, and bounded agent context.
- Cartography - Consolidates cloud, SaaS, identity, and infrastructure assets into a graph for security and operational analysis.
- CloudQuery - Extracts cloud and infrastructure configuration into queryable destinations for inventory, policy, and relationship analysis.
- Bazel Query - Queries build dependency graphs and reverse dependencies to compute affected targets and inspect build structure.
- code-review-graph - Maintains an incremental code graph for blast-radius analysis, affected tests, risk-scored reviews, and bounded agent context.
- Nx Affected - Uses the project graph and Git changes to run tasks only for directly or transitively affected projects.
- Pants Dependencies - Infers and validates target dependencies to support precise builds, tests, and change-scoped workflows.
- Turborepo Affected - Combines Git history with the package graph to scope monorepo tasks to affected packages.
- OpenRewrite - Applies structured, testable recipes across repositories for large-scale refactoring and dependency migrations.
- Sourcegraph Batch Changes - Plans, executes, tracks, and reviews coordinated code changes across many repositories.
- Conftest - Tests structured configuration with policy-as-code rules before changes reach deployment systems.
- CUE - Unifies data, schemas, constraints, and policy to validate configuration and generate consistent outputs.
- Open Policy Agent - Evaluates declarative policy decisions across CI, infrastructure, APIs, and application authorization.
- in-toto - Records and verifies authorized steps, actors, and artifacts across a software supply chain.
- OpenSSF Scorecard - Produces evidence-backed checks for security practices across open-source repositories.
- SLSA - Defines supply-chain security levels and provenance requirements for trustworthy software build artifacts.
- ArchUnit - Tests Java architecture constraints such as layers, dependencies, cycles, naming, and annotations as executable rules.
- Codex Security - Scans repositories, validates and fixes security findings, preserves scan history, and runs security checks in CI.
- deepsec - Runs resumable, agent-powered vulnerability investigations across large repositories with revalidation and structured findings.
- SonarQube - Aggregates static-analysis findings and quality gates across projects, branches, and pull requests.
- Aider Repository Map - Builds a compact map of important repository symbols and relationships to fit relevant structure into an LLM context window.
- Continue Codebase Awareness - Documents indexing, retrieval, embeddings, and context selection for repository-aware coding assistants.
- Repomix - Packages selected repository content into AI-friendly files with filtering, token counting, and security checks.
- AGENTS.md - Defines a simple repository instruction file for guiding coding agents with project-specific setup, testing, and conventions.
- Claude Code Memory - Documents hierarchical project instructions and scoped rules that persist repository knowledge across agent sessions.
- Model Context Protocol - Standardizes how AI applications discover and consume tools, resources, prompts, and contextual data from external servers.
- Language Server Protocol - Standardizes editor access to language intelligence such as symbols, references, diagnostics, and navigation.
- OpenTelemetry - Defines interoperable telemetry signals and semantic conventions for observing runtime systems across services.
- SARIF - Standardizes static-analysis results so tools, CI systems, and IDEs can exchange findings with locations and provenance.
- CodeSearchNet - Provides a large corpus and benchmark tasks for semantic code search across multiple programming languages.
- CrossCodeEval - Evaluates cross-file code completion where relevant context must be retrieved from other parts of a repository.
- RepoBench - Benchmarks repository-level code completion and retrieval under realistic cross-file dependencies.
- SWE-bench - Evaluates systems on real repository issues that require code understanding, modification, and test-based verification.
- SWE-bench Multimodal - Extends repository issue resolution evaluation to user-interface tasks with visual evidence.
- IEEE Working Conference on Mining Software Repositories - Publishes research on extracting, modeling, and learning from software repositories and development artifacts.
- SANER - Covers software analysis, evolution, architecture recovery, program comprehension, and reengineering.
- Building Evolutionary Architectures - Explains fitness functions and incremental architectural change for systems that must evolve without losing governance.
- Software Architecture: The Hard Parts - Examines distributed architecture decisions, trade-offs, coupling, workflows, and evolutionary change.
- Awesome Context Engineering - Surveys context construction, retrieval, memory, protocols, agent runtimes, evaluation, and production practices.
- Awesome Knowledge Graph - Curates knowledge-graph learning material, infrastructure, datasets, construction tools, and related projects.
- Static Analysis - Catalogs static-analysis tools across programming languages, configuration formats, infrastructure, and security domains.
Contributions are welcome. Read CONTRIBUTING.md for the two-minute pull request path, or use the Suggest a resource issue form if you prefer not to edit files.
Please submit one resource per pull request, explain which workspace-level question it helps answer, and disclose any affiliation. The dependency-free validator runs with:
npm testThis list is dedicated to the public domain under CC0 1.0 Universal. Linked resources retain their own licenses and terms.